Vehicle control system, information processing device, and master electronic control unit

This application is based upon and claims the benefit of priority from prior Japanese Patent Application No. 2023-129281, filed on Aug. 8, 2023, the entire contents of which are incorporated herein by reference.

The present disclosure relates to a vehicle control system, an information processing device, and a master electronic control unit.

Japanese Laid-Open Patent Publication No. 2013-243651 discloses a time synchronization system including an upstream packet transmission device and multiple downstream packet transmission devices. In the system, the multiple downstream packet transmission devices perform time synchronization with the upstream packet transmission device.

In recent years, a vehicle control system including multiple electronic control units communicably connected to each other via an in-vehicle network has been developed. In this system, one of the multiple electronic control units functions as a master electronic control unit, and the remaining electronic control units function as slave electronic control units. Advanced vehicle control can be realized by cooperation of the multiple electronic control units.

In order to realize advanced vehicle control, it is necessary to perform time synchronization between the master electronic control unit and the slave electronic control units. However, an anomaly may occur in time synchronization between any one of the multiple slave electronic control units and the master electronic control unit.

This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

A first aspect of the present disclosure provides a vehicle control system. The vehicle control system includes a master controller and multiple slave controllers configured to communicate with the master controller via an in-vehicle network. The vehicle control system is configured to perform acquiring accuracy-related information, which is information related to accuracy of time synchronization between the master controller and the slave controllers, from the master controller and the multiple slave controllers, and transmitting list information based on the accuracy-related information acquired from the master controller and the multiple slave controllers to the master controller and the multiple slave controllers.

A second aspect of the present disclosure provides an information processing device. The information processing device is configured to be communicably connected to the master electronic control unit and the multiple slave electronic control units via an in-vehicle network. The information processing device is configured to perform receiving accuracy-related information from the master electronic control unit and the multiple slave electronic control units, the accuracy-related information being information related to accuracy of time synchronization between the master electronic control unit and the slave electronic control units, and transmitting list information based on the accuracy-related information acquired from the master electronic control unit and the multiple slave electronic control units to the master electronic control unit and the multiple slave electronic control units.

A third aspect of the present disclosure provides a master electronic control unit. The master electronic control unit is configured to be communicably connected to the multiple slave electronic control units via an in-vehicle network. The master electronic control unit is configured to perform receiving accuracy-related information, which is information related to accuracy of time synchronization between the master electronic control unit and the slave electronic control units, from the multiple slave electronic control units, and to transmitting list information based on the accuracy-related information acquired from the multiple slave electronic control units to the multiple slave electronic control units.

Other features and aspects will be apparent from the following detailed description, the drawings, and the claims.

Throughout the drawings and the detailed description, the same reference numerals refer to the same elements. The drawings may not be to scale, and the relative size, proportions, and depiction of elements in the drawings may be exaggerated for clarity, illustration, and convenience.

This description provides a comprehensive understanding of the methods, apparatuses, and/or systems described. Modifications and equivalents of the methods, apparatuses, and/or systems described are apparent to one of ordinary skill in the art. Sequences of operations are exemplary, and may be changed as apparent to one of ordinary skill in the art, except for operations necessarily occurring in a certain order. Descriptions of functions and constructions that are well known to one of ordinary skill in the art may be omitted.

Exemplary embodiments may have different forms, and are not limited to the examples described. However, the examples described are thorough and complete, and convey the full scope of the disclosure to one of ordinary skill in the art.

In this specification, “at least one of A and B” should be understood to mean “only A, only B, or both A and B.”

Hereinafter, an embodiment of a vehicle control system and an information processing device will be described with reference to.

Vehicle Control System

As shown in, the vehicle control systemincludes multiple electronic control units configured to communicate with each other via an in-vehicle network. An example of the in-vehicle network is Ethernet (registered trademark).

The multiple electronic control units include a master electronic control unit, multiple slave electronic control units, and a validator electronic control unit. Each of the multiple electronic control units includes a processor and a memory. The memory includes a memory that stores a control program executed by the processor and a memory that temporarily stores data.

In the present embodiment, the master electronic control unitcorresponds to a master controller. The slave electronic control unitcorresponds to a slave controller. The validator electronic control unitcorresponds to an information processing device.

Hereinafter, the electronic control unit is referred to as an ECU. Therefore, the master electronic control unitis referred to as a master ECU. The slave electronic control unitis referred to as a slave ECU. Validator electronic control unitis referred to as a validator ECU.

The vehicle control systemrealizes advanced vehicle control by causing the multiple ECUs connected via the in-vehicle network to cooperate with each other. Therefore, the vehicle control systemneeds to monitor whether an anomaly occurs in the time synchronization between the ECUs. The processing for determining whether or not the anomaly of the time synchronization occurs is repeatedly executed in parallel with the processing of the vehicle control.

The in-vehicle network is constituted by the switch ECUand the bus. The master ECU, the multiple slave ECUs, and the validator ECUare each connected to the switch ECUvia a bus.

The master ECUoutputs first time information serving as a reference. The multiple slave ECUsare respectively connected to the switch ECUvia the bus. Each of the multiple slave ECUsacquires the first time information through exchange of signals with the master ECU, and calculates a delay time pDelay of transmission in the in-vehicle network. Then, the multiple slave ECUsoutput the second time information subjected to the time synchronization using the delay time pDelay. The calculation of the delay time pDelay will be described later.

The multiple slave ECUsare ECUs that realize various functions in the vehicle. Examples of such an ECU include an engine ECU, a motor generator ECU, a brake ECU, and a driving assistance ECU. The engine ECU controls the engine. The motor generator ECU controls the motor generator. The brake ECU controls the brake device. The driving assistance ECU is an ECU that realizes advanced driving assistance.

Collection of Information for Diagnosing Synchronization Anomaly

In the vehicle control system, signals are periodically exchanged between the master ECUand the slave ECU, and each of the master SL and the slave SL acquires time information when the signal is transmitted and time information when the signal is received. Then, the validator ECUperiodically determines whether or not the synchronization anomaly between the first time information and the second time information has occurred.is a sequence diagram illustrating a flow of a process in which the validator ECUcollects information necessary for determining whether or not an anomaly has occurred in time synchronization between the master ECUand the slave ECU, from the master ECUand the slave ECU. The vehicle control systemperiodically executes this sequence in parallel with processing related to the control of the vehicle during operation. This sequence is executed by the validator ECU, the master ECU, and each of the multiple slave ECUs. In, only one of the multiple slave ECUsis shown.

In a first step S, the master ECUtransmits a first signal Sync to the slave ECU. In the next step S, the master ECUacquires the first time information when the first signal Sync is transmitted as the first time t_. The first time information is time information measured by the master ECU.

Upon receiving the first signal Sync, the slave ECUshifts the processing to step S. In step S, the slave ECUacquires the second time information at the time of receiving the first signal Sync as the second time t_. The second time information is time information measured by the slave ECU.

When the master ECUtransmits the first signal Sync to the slave ECU, the master Sshifts the processing to step SL. In step S, the master ECUtransmits the fourth signal FoUp to the slave ECU. For example, the master ECUtransmits the time stamp of the first time t_as the fourth signal FoUp.

The slave ECUacquires the first time t_by receiving the first signal Sync. Upon acquiring the first time t_, the slave ECUshifts the processing to step S. In a step S, the slave ECUtransmits a second signal Req to the master ECU. In the subsequent step S, the slave ECUacquires the second time information at the time of transmitting the second signal Req as the third time t_.

Upon receiving the second signal Req, the master ECUshifts the processing to step S. In step S, the master ECUacquires the first time information at the time of receiving the second signal Req as the fourth time t_. In a next step S, the master ECUtransmits a third signal Resp to the slave ECU. In the subsequent step S, the master ECUacquires the first time information when the third signal Resp is transmitted as the fifth time t_.

Upon receiving the third signal Resp, the slave ECUshifts the processing to step S. In the step S, the slave ECUacquires the second time information at the time of receiving the third signal Resp as the sixth time t_.

Upon acquiring the fifth time t_, the master ECUshifts the processing to step S. In step S, the master ECUtransmits a fifth signal RespFoUp to the slave ECU. For example, the master ECUtransmits the time stamp of the fourth time t_and the time stamp of the fifth time t_as the fifth signal RespFoUp. The slave ECUacquires the fourth time t_and the fifth time t_by receiving the fifth signal RespFoUp. Upon acquiring the fourth time t_and the fifth time t_, the slave ECUshifts the processing to step S. In step S, the slave ECUcalculates the delay time pDelay. The delay time pDelay is a time of a transmission delay of a signal between the master ECUand the slave ECU. The slave ECUcalculates the delay time pDelay based on the third time t_, the fourth time t_, the fifth time t_, and the sixth time t_. For example, the slave ECUcalculates a first difference that is a difference obtained by subtracting the third time t_from the sixth time t_. The slave ECUcalculates a second difference that is a difference obtained by subtracting the fourth time t_from the fifth time t_. Then, the slave ECUcalculates the delay time pDelay by dividing the difference obtained by subtracting the second difference from the first difference by two.

On the other hand, when transmitting the fifth signal RespFoUp, the master ECUshifts the processing to step S. In step S, the master ECUsends a master timing record message MTRM to the validator ECU. The master timing record message MTRM includes the sequence ID of the transmitted first signal Sync, the time stamp of the first time t_, the time stamp of the fourth time t_, and the time stamp of the fifth time t_. In the present embodiment, the master timing record message MTRM corresponds to accuracy-related information, which is information related to the accuracy of time synchronization between the master ECUand the slave ECU.

After calculating the delay time pDelay, the slave ECUshifts the processing to step S. In step S, the slave ECUsends a slave timing record message STRM to the validator ECU. The slave timing record message STRM includes the identification of the slave ECU, the sequence identification of the received first signal Sync, the sequence identification of the received fourth signal FoUp, and the sequence identification of the received fifth signal RespFoUp. Further, the slave timing record message STRM includes a time stamp of the second time t_, a time stamp of the third time t_, and a time stamp of the sixth time t_. Further, the slave timing record message STRM includes the value of the delay time pDelay. In the present embodiment, the slave timing record message STRM corresponds to accuracy-related information.

That is, the validator ECUacquires the master timing record message MTRM and the slave timing record message STRM as the accuracy-related information from the master ECUand the slave ECUthrough the execution of the sequence illustrated in.

As described above, the vehicle control systemincludes multiple slave ECUs. Therefore, the validator ECUacquires the accuracy-related information related to the accuracy of the time synchronization between the first slave ECU among the multiple slave ECUsand the master ECU, from the first slave ECU and the master ECU. The validator ECUis configured to acquire the accuracy-related information. Further, the validator ECUacquires, from the second slave ECU and the master ECU, the accuracy-related information related to the accuracy of the time synchronization between the second slave ECU among the multiple slave ECUsand the master ECU. In addition, the validator ECUacquires the accuracy-related information regarding the accuracy of the time synchronization between the third slave ECU among the multiple slave ECUsand the master ECU, from the third slave ECU and the master ECU.

Diagnosis of Synchronization Anomaly

is a sequence diagram showing a processing flow when the validator ECUdiagnoses the synchronization anomaly and transmits the diagnostic result to the master ECUand the multiple slave ECUs. Note thatillustrates only two of the multiple slave ECUs.

In step S, the validator ECUdiagnoses a synchronization anomaly.is a flowchart showing a processing routine for diagnosing a synchronization anomaly. In a first step S, the validator ECUsets a coefficient N to 1. In the subsequent step S, the validator ECUcalculates the determination necessary information. The determination necessary information is information necessary for determining whether or not an anomaly has occurred in time synchronization between the master ECUand the N-th slave ECU. The validator ECUcalculates determination necessary information based on the accuracy-related information.

For example, the validator ECUcalculates a cycle shift. The cycle deviation is a deviation between the calculation cycle of the master ECUand the calculation cycle of the N-th slave ECU. For example, the validator ECUcalculates a third difference obtained by subtracting the first time t_acquired in the previously executed sequence from the first time t_acquired in the currently executed sequence. The third difference corresponds to the cycle of processing in the master ECU. Similarly, the validator ECUcalculates a fourth difference obtained by subtracting the second time t_acquired in the previously executed sequence from the second time t_acquired in the currently executed sequence. The fourth difference corresponds to the processing cycle in the N-th slave ECU. Then, the validator ECUcalculates the calculated value by subtracting the fourth difference from the third difference. This calculated value corresponds to the period deviation. Hereinafter, the calculated value is referred to as a period deviation equivalent value”.

Subsequently, the validator ECUcalculates an offset between the first time information and the second time information. For example, the validator ECUcalculates a fifth difference obtained by subtracting the delay time pDelay from the second time t_. Then, the validator ECUcalculates absolute values of differences obtained by subtracting the fifth differences from the first time t_. This absolute value is the offset. Hereinafter, the absolute value is referred to as an “offset equivalent value”.

In the present embodiment, the period shift equivalent value and the offset equivalent value are the determination necessary information. When the validator ECUcalculates the cycle shift equivalent value and the offset equivalent value, the validator ECUshifts the processing to step S. In step S, the validator ECUexecutes a determination process of determining whether an anomaly occurs in the time synchronization between the master ECUand the N-th slave ECU based on the accuracy-related information. Here, the validator ECUperforms the determination process using the determination-required information calculated in step S. As described above, the determination necessary information is information calculated based on the accuracy-related information.

An example of the determination process will be described. When at least one of the following two conditions (A1) and (A2) is satisfied, the validator ECUdetermines that an anomaly has occurred in the time synchronization between the master ECUand the N-th slave ECU. On the other hand, when none of the two conditions (A1) and (A2) is satisfied, the validator ECUdetermines that no anomaly has occurred in the time synchronization between the master ECUand the N-th slave ECU.

(A1) It can be determined that there is a cycle shift.

(A2) It can be determined that there is an offset deviation.

For example, the validator ECUdetermines whether or not the cycle shift equivalent value is equal to or larger than the cycle shift determination value. A criterion for determining whether or not there is a period shift is set as a period shift determination value. That is, the validator ECUdetermines that there is a cycle shift when the cycle shift determination value is equal to or larger than the cycle shift determination value. On the other hand, the validator ECUdetermines that there is no cycle shift when the cycle shift determination value is less than the cycle shift determination value.

For example, the validator ECUdetermines whether or not the offset equivalent value is equal to or larger than the offset determination value. A criterion for determining whether or not there is an offset deviation is set as an offset determination value. That is, when the offset equivalent value is equal to or larger than the offset determination value, the validator ECUdetermines that there is an offset deviation. On the other hand, when the offset equivalent value is less than the offset determination value, the validator ECUdetermines that there is no offset deviation.

When the validator ECUexecutes the determination processing, the validator ECUshifts the processing to step S. In step S, the validator ECUupdates the coefficient N so that the coefficient N is increased by 1. In the subsequent step S, the validator ECUdetermines whether or not the coefficient N is larger than the determination coefficient Nth. The number of slaves ECUincluded in the vehicle control systemis set as the determination coefficient Nth. In other words, the validator ECUdetermines whether or not the determination process has been executed for all the slaves ECU. When the coefficient N is equal to or less than the determination coefficient Nth, there is a slave ECUfor which the determination process has not been executed among the Nth slave ECU. Therefore, when the coefficient N is equal to or less than the determination coefficient Nth (S: NO), the validator ECUshifts the processing to step S. On the other hand, when the coefficient N is larger than the determination coefficient Nth, the determination process can be executed on all of the Nth slaves ECU. Therefore, when the coefficient N is larger than the determination coefficient Nth (S: YES), the validator ECUshifts the processing to step S.

In step S, the validator ECUcreates list information. The list information is information based on the accuracy-related information acquired from the master ECUand the multiple slave ECUs. In the present embodiment, the validator ECUcreates the determination result by the determination process for the multiple slave ECUsas the list information. Thereafter, the validator ECUends the processing routine illustrated in.